EY refers to the global organization, and may refer to one or more, of the member firms of Ernst & Young Global Limited, each of which is a separate legal entity. Ernst & Young Global Limited, a UK company limited by guarantee, does not provide services to clients.
Welcome to “Gateway to data privacy and protection,” an innovative podcast series that delves deep into the realm of data privacy and protection.
The role of fintechs and payments intermediaries – Data fiduciary vs. data processor?
While the popular view is that fintechs and payments intermediaries would be deemed as data processors, the answer is not really as simple. There are a number of unique use cases and operating models due to which the balance may tilt towards being a fiduciary. While the Digital Personal Data Protection (DPDP) Act does not define the role of a “joint fiduciary” similar to the “joint controller” in GDPR, there is no restriction on the number of fiduciaries. Service models where the traditional fiduciaries such as banks operate in an outsourced/SaaS model with fintech partners in a ‘co-branded’ manner are a classic scenario where both could be perceived as fiduciaries while the bank continues to own the customer relationship. Similarly, fintechs that provide services related to fraud monitoring, threat intelligence, concierge, tokenization could also be involved in determining the purpose of personal data collection without having a direct customer-facing interface. Hence, while revisiting service contracts is of essence, it is vital for fintechs and payments intermediaries’ privacy teams to agree upon obligations and liabilities in the context of digital personal data protection with the entities that own the customer relationship. Such agreed upon obligations and liabilities will also be applicable to the subcontractors/vendors on-boarded by the fintechs and payments intermediaries and hence adequate due diligence and contracting with them will also be essential.
Another area of focus where the responsibilities would be shared between the entities would be that of managing the Data Principal’s rights requests. While the rights of grievance redressal and nomination would typically be handled by the entity managing the customer relationship, the actions coming from requests related to right to access, correction and erasure will need to be addressed by fintechs and payments intermediaries as well. Having an integrated workflow to manage such requests across entities will need both, a service-level agreement (SLA) based governance model as well as a technical implementation to be planned.